#!/usr/bin/env python2

"""
Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
See the file 'LICENSE' for copying permission
"""

import re

from craw.modules.trail.plugins.util import wget_content

__url__ = "http://malwaredomains.lehigh.edu/files/domains.txt"
__check__ = "safebrowsing.clients.google.com"
__reference__ = "malwaredomains.com"

maintainer_url = __reference__
maintainer = __check__
list_source_url = __url__
category = "malwaredomains"


def fetch():
    retval = {}
    content = wget_content(__url__)

    if __check__ in content:
        for line in content.split('\n'):
            line = line.strip('\r').replace('\xa0', "")
            if not line or line.startswith('#'):
                continue
            items = line.split('\t')
            if len(items) > 4:
                if items[2].endswith(".anbtr.com"):  # anubis sinkhole (static/sinkhole_anubis.txt)
                    continue
                info = items[3]
                for _ in (
                        "andromeda", "banjori", "banload", "bedep", "bhek", "bhek2", "blackvine", "browlock", "citadel",
                        "corebot", "cridex", "cryptowall", "darkcomet", "dexter", "dircrypt", "dridex", "dyre",
                        "fareit",
                        "geinimi", "gh0st", "gorynych", "goz", "gozi", "gumblar", "hesperbot", "kaixin", "katrina",
                        "kazy",
                        "keitaro", "kelihos", "kins", "koobface", "kryptik", "matsnu", "napolar", "necurs", "neurevt",
                        "njrat",
                        "nymaim", "passwordstealer", "pkybot", "pony", "p0ny", "posmalware", "poweliks", "pushdo",
                        "pykspa",
                        "qakbot", "ramnit", "ranbyus", "rbn", "rovnix", "runforestrun", "russiandoll", "shiotob",
                        "shylock",
                        "simda", "soaksoak", "sofacy", "suppobox", "teslacrypt", "tinba", "vawtrak", "waledac",
                        "yigido",
                        "zemot", "zeus"):
                    if re.search(r"(?i)\b%s\b" % _, info):
                        info = "%s (malware)" % _
                        break
                retval[items[2]] = (info.replace('_', ' '), __reference__)

    return retval
